FastAPI

Passkeys in Production: How One Developer Replaced Passwords with Face ID in Three Days Using FastAPI and Next.js

Yaroslav Morozov details a complete production implementation of Passkeys based on the WebAuthn standard and FIDO2 protocols. The article explains why Passkeys eliminate phishing and database breach risks compared to traditional passwords while providing biometric login via Face ID or Touch ID. It covers database schema design with PostgreSQL tables for credentials and challenges, SQLAlchemy models, and minimal dependencies including py-webauthn on the backend and SimpleWebAuthn on the frontend. Full working code for registration and authentication flows is provided, showing how Passkeys integrate with existing JWT token systems without major refactoring. The guide includes environment configuration, error handling, challenge management with five-minute TTL, and security considerations such as sign count verification to detect cloned keys.

Security Researcher Builds SAST Scanner for AI-Generated Code and Audits 3,800 Public Repositories

A developer released AigisSAST, a lightweight open-source static analysis tool written in pure Python with no external dependencies, specifically tuned to detect common mistakes made by AI coding assistants. The scanner was run across roughly 3,800 repositories ranging from small pet projects to popular open-source platforms. It identified thousands of potential secrets and misconfigurations, yet manual review reduced the number of genuine leaks to approximately 30 cases, mostly Telegram bot tokens, database credentials, and committed .env files. The project also examined 471 production-grade Telegram bots handling payments and VPN services, uncovering 31 repositories that exposed real credentials either in current code or in Git history. AigisSAST includes 21 detection rules, 193 regression tests, automatic remediation via the fix command, and seamless integration with GitHub Actions. The author deliberately avoided validating any discovered keys to stay within ethical research boundaries.

Can IDOR Vulnerabilities Be Found Through Static Analysis? New Python Kernel Aims to Answer the Question

A researcher has developed a static analysis module for detecting Insecure Direct Object Reference (IDOR) vulnerabilities in Python web applications. The tool moves beyond simple heuristics by tracking the relationship between user-controlled identifiers, database objects, and authorization checks. It supports Django, Django REST Framework, Flask, and FastAPI, using a custom taint-tracking system called SIAOD to label data origins. Existing approaches such as OpenAPI specifications, broad AST heuristics, Semgrep, and CodeQL were analyzed and found insufficient for capturing the precise semantics of IDOR. Testing on 150 small repositories yielded 48 true positives out of 112 findings, while analysis of 12 million lines of production code from 15 companies produced only five confirmed issues amid hundreds of false positives caused by authorization logic residing outside handler functions. The work demonstrates both the feasibility and current limitations of deterministic static detection for this vulnerability class.

Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access

A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.

Developer Exposes 12 Vulnerabilities in FastAPI Todo App After 176 Bots Bypass Protections

A developer building a student-focused todo planner on FastAPI discovered that 176 of 238 new accounts were bots that bypassed three layers of protection including rate limiting and email verification. The issues stemmed from in-memory counters reset on every deployment, uvicorn trusting any X-Forwarded-For header, and email verification never being enforced in code. A full audit revealed additional flaws such as stored XSS via JSON-LD on public Q&A pages and an IDOR allowing any authenticated user to read all tasks in a project by supplying its ID. Fixes included moving rate limits to the database, properly extracting the client IP from the rightmost X-Forwarded-For entry, adding signed form timestamps, and escaping JSON for script contexts. The case highlights common pitfalls when deploying Python web services behind nginx without strict trust boundaries.

Browser Policy Manager 0.9.5 Release Candidate Adds Comprehensive Multi-Language Documentation Portal

Browser Policy Manager (BPM) is approaching its 1.0.0 release as an open-source tool designed for preparing, validating, and exporting Firefox Enterprise policy profiles. The 0.9.5 update introduces four current Firefox schema channels including Release 153, ESR 153.0, ESR 140.13, and ESR 115.38, along with migration assistance from older ESR versions. A full documentation portal built in DITA now ships with the product, covering user guides, Firefox policy references, CIS benchmark mappings, and administrator instructions across six languages. The portal integrates directly with the BPM interface through manifests and UI target maps, providing contextual help without server dependencies. Local search uses static indexes with deterministic ranking, while future RAG capabilities are planned with strict source verification and no model training on documentation. The project emphasizes reproducible builds, locale completeness checks, and clear separation between automated mappings and manual compliance validation.